From: Matthew Somerville
To:
Subject: Re:
Date: 4 July 2004 18:13
Thank you for your email of the 22nd of June.
I apologise if I have caused any upset or inconvenience as this was not my
intention. I am happy to discuss the matter with you to try and resolve it
amicably.
From a practical perspective, I believe that my site provides a useful
service, in particular in giving access to information that is not available
to everyone through your website. I think its key effect is to lead to more
people attending Odeon cinemas (I cannot use your site, so without my
version I would not be attending an Odeon to see films).
You will realise that I am not taking any commercial advantage from the
site - it exists only to provide a service to others and to provide a
greater access than that currently provided by your site. In that
connection, and in relation to something you said in your email, I do not
collect or store any user data myself. Any user data input via my site is
passed straight through to the registration page of your website. All users
are therefore actually registered on your site, along with their data
protection choices. It is as if they went to the registration page of your
site and filled in their details there. The same applies to amendments to
and removing their data.
In the process of creating my site, I uncovered no less than three security
holes in your site, leading to public availability of all personal data held
on the Odeon server. I immediately informed Odeon and received the following
reply:
"On behalf of ODEON I would like to extend my thanks in bringing this
flaw to our attention. As a result of the details you have sent to us, the
issue was passed to our web engineers who have solved the bug with immediate
effect. Again, thank you for your feedback and for using www.odeon.co.uk"
Also, in an article in the Independent last September, you said you were not
going to ask me to take the site down - may I ask what caused your change of
view?
In view of the above, rather than taking the site down I believe that it
would be in everyones' interests (including yours) if it stayed up, although
I certainly do not wish to get into a dispute about this with you and would
only want it to do so on the basis that you are happy with this. Therefore,
is there some way that a sensible compromise can be found so that you are
happy for the site to stay up? I am happy to consider making amendments to
the site if you would like to emphasise to a greater extent than at present
that it is not officially connected with Odeon.
Perhaps you would be kind enough to consider this and to let me know what
you think?
Yours,
Matthew Somerville